filenameDead Space 2.exe
size399893 (0x61a15)
md56a802c9d89c87d9592cde521e6e85c7e
typePE32 executable (GUI) Intel 80386, for MS Windows
mimetypeapplication/x-dosexec
clamavOK
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x90
blocks_in_file3
num_relocs0
header_paragraphs4
min_extra_paragraphs0
max_extra_paragraphs0xffff
ss0
sp0xb8
checksum0
ip0
cs0
reloc_table_offset0x40
overlay_number0
reserved00
oem_id0
oem_info0
reserved20
reserved30
reserved40
reserved50
reserved60
lfanew0x100

Rich Header

lib idversiontimes used
1180473
1472997
10804711
480472
9521901
10183
93217911
11978281
1703031911
158303192
617351

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

SignaturePE
Machine0x14c
NumberOfSections5
TimeDateStamp0x4ce553f5
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x1f200
SizeOfInitializedData0xc800
SizeOfUninitializedData0
AddressOfEntryPoint0x1d262
BaseOfCode0x1000
BaseOfData0x21000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x2f000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x1f01a0x1f200R-X CODE
.rdata0x210000x5a5c0x5c00R-- IDATA
.data0x270000x4d980xc00RW- IDATA
.sxdata0x2c00040x200RW- IDATA
.rsrc0x2d0000x1bc00x1c00R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x25ee40x8c
RESOURCE0x2d0000x1bc0
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x210000x22c
Delay_IAT00
CLR_Header00
typenamesizecp
ICON#17440
ICON#22960
DIALOG#50010600
DIALOG#5012940
DIALOG#5027560
DIALOG#5523020
STRING#73920
STRING#137560
STRING#141140
STRING#32460
STRING#38720
STRING#441480
STRING#45440
STRING#662440
STRING#671060
GROUP_ICON#1340
VERSION#16880
idlangstring
1031033Can not open file '{0}' as archive
1041033Can not open encrypted archive '{0}'. Wrong password?
1051033The system cannot allocate the required amount of memory
1061033Unknown Error
1071033Unsupported archive type
1991033Update operations are not supported for this archive.
2001033Cannot create folder '{0}'
2011033File is not supported archive.
2021033CRC failed in '{0}'. File is broken.
2031033Data error in '{0}'. File is broken
2041033Unsupported compression method for '{0}'.
2051033CRC failed in encrypted file '{0}'. Wrong password?
2061033Data error in encrypted file '{0}'. Wrong password?
2071033Specify a location for extracted files.
2081033Can not open output file '{0}'.
2091033Extracting
5031033Message
6001033modified on
6011033{0} bytes
7001033Paused
7011033&Foreground
7021033&Continue
7031033Are you sure you want to cancel?
7041033&Close
10411033Full pathnames
10421033Current pathnames
10431033No pathnames
10511033Ask before overwrite
10521033Overwrite without prompt
10531033Skip existing files
10561033Auto rename
10571033Auto rename existing files
module_namehintordfunction_name
OLEAUT32.dll2
OLEAUT32.dll6
OLEAUT32.dll9
ole32.dll58CoInitialize
ole32.dll104CoUninitialize
USER32.dll485MessageBoxW
USER32.dll725wsprintfA
USER32.dll594SetDlgItemTextA
USER32.dll468MapDialogRect
USER32.dll560ScreenToClient
USER32.dll403InvalidateRect
USER32.dll633SetTimer
USER32.dll159DialogBoxParamW
USER32.dll158DialogBoxParamA
USER32.dll639SetWindowLongA
USER32.dll366GetWindowLongA
USER32.dll372GetWindowRect
USER32.dll657ShowWindow
USER32.dll491MoveWindow
USER32.dll664SystemParametersInfoA
USER32.dll377GetWindowTextLengthW
USER32.dll588SetCursor
USER32.dll376GetWindowTextLengthA
USER32.dll375GetWindowTextA
USER32.dll646SetWindowTextW
USER32.dll645SetWindowTextA
USER32.dll575SendMessageW
USER32.dll459LoadStringW
USER32.dll458LoadStringA
USER32.dll55CharUpperW
USER32.dll52CharUpperA
USER32.dll419IsDlgButtonChecked
USER32.dll198EndDialog
USER32.dll273GetDlgItem
USER32.dll445LoadIconA
USER32.dll570SendMessageA
USER32.dll513PostMessageA
USER32.dll441LoadCursorA
USER32.dll436KillTimer
USER32.dll378GetWindowTextW
SHELL32.dll183SHGetMalloc
SHELL32.dll188SHGetPathFromIDListA
SHELL32.dll121SHBrowseForFolderA
SHELL32.dll172SHGetFileInfoA
MSVCRT.dll106__p__commode
MSVCRT.dll111__p__fmode
MSVCRT.dll129__set_app_type
MSVCRT.dll183_controlfp
MSVCRT.dll131__setusermatherr
MSVCRT.dll271_initterm
MSVCRT.dll88__getmainargs
MSVCRT.dll143_acmdln
MSVCRT.dll585exit
MSVCRT.dll72_XcptFilter
MSVCRT.dll211_exit
MSVCRT.dll390_onexit
MSVCRT.dll85__dllonexit
MSVCRT.dll14public: virtual __thiscall type_info::~type_info(void)

??1type_info@@UAE@XZ

MSVCRT.dll202_except_handler3
MSVCRT.dll166_beginthreadex
MSVCRT.dll665memset
MSVCRT.dll742wcslen
MSVCRT.dll663memcpy
MSVCRT.dll606free
MSVCRT.dll657malloc
MSVCRT.dll65_CxxThrowException
MSVCRT.dll664memmove
MSVCRT.dll402_purecall
MSVCRT.dll662memcmp
MSVCRT.dll73__CxxFrameHandler
MSVCRT.dll157_adjust_fdiv
KERNEL32.dll431GetStartupInfoA
KERNEL32.dll375GetModuleHandleA
KERNEL32.dll537InitializeCriticalSection
KERNEL32.dll708ResetEvent
KERNEL32.dll779SetEvent
KERNEL32.dll73CreateEventA
KERNEL32.dll901WaitForSingleObject
KERNEL32.dll888VirtualFree
KERNEL32.dll885VirtualAlloc
KERNEL32.dll314GetCurrentProcess
KERNEL32.dll806SetPriorityClass
KERNEL32.dll944lstrcatA
KERNEL32.dll469GetTickCount
KERNEL32.dll841Sleep
KERNEL32.dll187FileTimeToLocalFileTime
KERNEL32.dll899WaitForMultipleObjects
KERNEL32.dll143EnterCriticalSection
KERNEL32.dll583LeaveCriticalSection
KERNEL32.dll433GetStdHandle
KERNEL32.dll378GetModuleHandleW
KERNEL32.dll408GetProcAddress
KERNEL32.dll188FileTimeToSystemTime
KERNEL32.dll773SetEndOfFile
KERNEL32.dll919WriteFile
KERNEL32.dll683ReadFile
KERNEL32.dll784SetFilePointer
KERNEL32.dll347GetFileSize
KERNEL32.dll77CreateFileA
KERNEL32.dll204FindFirstFileW
KERNEL32.dll201FindFirstFileA
KERNEL32.dll197FindClose
KERNEL32.dll313GetCurrentDirectoryW
KERNEL32.dll312GetCurrentDirectoryA
KERNEL32.dll354GetFullPathNameW
KERNEL32.dll353GetFullPathNameA
KERNEL32.dll959lstrlenA
KERNEL32.dll125DeleteFileW
KERNEL32.dll124DeleteFileA
KERNEL32.dll72CreateDirectoryW
KERNEL32.dll69CreateDirectoryA
KERNEL32.dll615MoveFileW
KERNEL32.dll699RemoveDirectoryW
KERNEL32.dll783SetFileAttributesW
KERNEL32.dll612MoveFileA
KERNEL32.dll698RemoveDirectoryA
KERNEL32.dll797SetLastError
KERNEL32.dll80CreateFileW
KERNEL32.dll788SetFileTime
KERNEL32.dll46CloseHandle
KERNEL32.dll235FormatMessageW
KERNEL32.dll234FormatMessageA
KERNEL32.dll594LocalFree
KERNEL32.dll374GetModuleFileNameW
KERNEL32.dll373GetModuleFileNameA
KERNEL32.dll11AreFileApisANSI
KERNEL32.dll361GetLastError
KERNEL32.dll905WideCharToMultiByte
KERNEL32.dll619MultiByteToWideChar
KERNEL32.dll122DeleteCriticalSection
KERNEL32.dll479GetVersionExA
KERNEL32.dll265GetCommandLineW
KERNEL32.dll782SetFileAttributesA

StringTable 040904b0

CompanyNameIgor Pavlov
FileDescription7z SFX
FileVersion9.20
InternalName7z.sfx
LegalCopyrightCopyright (c) 1999-2010 Igor Pavlov
OriginalFilename7z.sfx.exe
ProductName7-Zip
ProductVersion9.20

VS_FIXEDFILEINFO

FileVersion9.20.0.0
ProductVersion9.20.0.0
StrucVersion0x10000
FileFlagsMask0x3f
FileFlags0
FileOS0x40004
FileType1
FileSubtype0
offsetsizetypecomment
0162816EXE11/18/2010 16:27:33#
15c115HTM#
27c00237077BINoverlay data past EOF#
Scanning the drive for archives:
1 file, 399893 bytes (391 KiB)


--
Type = 7z
Offset = 162816
Physical Size = 237077
Headers Size = 414
Method = LZMA:23
Solid = +
Blocks = 1

   Date      Time    Attr         Size   Compressed  Name
------------------- ----- ------------ ------------  ------------------------
2011-08-17 16:30:50 .....       420288       236663  Dead Space 2/ds_slot_01.deadspace2saved
2011-08-17 17:32:00 .....       420288               Dead Space 2/ds_slot_02.deadspace2saved
2011-08-17 17:55:36 .....       420288               Dead Space 2/ds_slot_03.deadspace2saved
2011-08-17 18:16:28 .....       420288               Dead Space 2/ds_slot_04.deadspace2saved
2011-08-17 21:34:08 .....       420288               Dead Space 2/ds_slot_05.deadspace2saved
2011-08-17 21:55:36 .....       420288               Dead Space 2/ds_slot_06.deadspace2saved
2011-08-18 18:27:50 .....       420288               Dead Space 2/ds_slot_07.deadspace2saved
2011-08-18 19:36:56 .....       420288               Dead Space 2/ds_slot_08.deadspace2saved
2011-08-18 20:05:24 .....       420288               Dead Space 2/ds_slot_09.deadspace2saved
2011-08-18 20:33:02 .....       420288               Dead Space 2/ds_slot_10.deadspace2saved
2011-08-18 21:14:58 .....       420288               Dead Space 2/ds_slot_11.deadspace2saved
2011-08-18 21:37:36 .....       420288               Dead Space 2/ds_slot_12.deadspace2saved
2011-08-18 21:48:56 .....       420288               Dead Space 2/ds_slot_13.deadspace2saved
2011-08-18 22:28:20 .....       420288               Dead Space 2/ds_slot_14.deadspace2saved
2011-08-18 22:40:02 .....       420288               Dead Space 2/ds_slot_15.deadspace2saved
2011-08-18 22:46:10 .....       420288               Dead Space 2/ds_slot_19.deadspace2saved
2011-08-17 14:29:02 .....       420288               Dead Space 2/ds_slot_20.deadspace2saved
2011-08-18 22:49:06 D....            0            0  Dead Space 2
------------------- ----- ------------ ------------  ------------------------
2011-08-18 22:49:06            7144896       236663  17 files, 1 folders
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable







everything is OK